[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","odeik","name","form-handler-infinitepay-sqlite-resend","path","main.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/odeik/form-handler-infinitepay-sqlite-resend/code/main.ts","extension","id","19652b39-5847-418b-869a-d53df5548ffe","fileId","1df4ed5a-af99-11f1-b5cd-1607ee4eb77e","parentId","branchId","1b502c53-2456-4abd-b47d-8024fbca1832","branchVersion",26,"latest",true,"createdAt",["D",1789334276046],"version",9,"fileType","http","content","/**\n * InfinitePay checkout — HTTP val.\n *\n * Routes\n * GET / health check — touches no database\n * POST /link create a checkout link for an order\n * POST /webhook InfinitePay payment notification\n * OPTIONS * CORS preflight\n *\n * SECURITY NOTE. On Val Town's free plan this source is world-readable, so\n * assume an attacker knows every route and payload shape below. Nothing here\n * relies on secrecy of the code:\n * - prices come from `bundle_discounts`, never from the request body, so a\n * tampered payload cannot buy a book for R$1;\n * - /webhook is a public, unauthenticated endpoint. InfinitePay signs nothing,\n * so its payload is treated as a hint and verified against their own\n * payment_check endpoint before an order is ever marked paid. That check is\n * the whole security boundary: a forged notification cannot fabricate a\n * payment, and it is the reason no shared secret is needed here.\n * Every configurable value is an env var — see README.md.\n */\nimport {\n getBundle,\n getOrder,\n insertOrder,\n markPaid,\n setCheckoutUrl,\n} from \"./db.ts\";\nimport { createLink, paymentCheck } from \"./infinitepay.ts\";\nimport { selectOne } from \"./db.ts\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders(req) });\n }\n\n try {\n // Touches nothing: no database, no env vars. If this responds but /link\n // hangs, the problem is SQLite, not the val.\n if (req.method === \"GET\" && path === \"/\") {\n const health: Record = {\n ok: true,\n service: \"checkout\",\n routes: [\"POST /link\", \"POST /webhook\"],\n };\n // ?db=1 adds one trivial read. Opt-in so the plain health check stays\n // answerable even when SQLite is the thing that is broken.\n if (url.searchParams.has(\"db\")) health.db = await probeDb();\n return json(req, health);\n }\n\n if (req.method === \"POST\" && path === \"/link\") return await handleLink(req);\n if (req.method === \"POST\" && path === \"/webhook\") {\n return await handleWebhook(req);\n }\n\n return json(req, { error: \"not_found\" }, 404);\n } catch (error) {\n console.error(\"Unhandled error\", error);\n return json(req, { error: \"internal_error\" }, 500);\n }\n}\n\n/* -------------------------------------------------------------- POST /link */\n\nasync function handleLink(req: Request): Promise {\n const origin = req.headers.get(\"Origin\");\n if (origin && !isAllowedOrigin(origin)) {\n return json(req, { error: \"forbidden_origin\" }, 403);\n }\n\n let body: Record;\n try {\n body = await req.json();\n } catch {\n return json(req, { error: \"invalid_json\" }, 400);\n }\n\n const bookSlug = str(body.book, 64);\n const units = Number(body.quantity);\n\n if (!bookSlug || !Number.isInteger(units) || units < 1) {\n return json(req, { error: \"invalid_product\" }, 400);\n }\n\n // The price is resolved here and nowhere else. Anything price-shaped in the\n // request body is ignored on purpose.\n const bundle = await getBundle(bookSlug, units);\n if (!bundle) return json(req, { error: \"unknown_product\" }, 404);\n\n const amountCents = bundle.units * bundle.unit_price_cents;\n\n const name = str(body.name, 120);\n const email = str(body.email, 160);\n if (!name || !email || !isEmail(email)) {\n return json(req, { error: \"invalid_customer\" }, 400);\n }\n\n // Both URLs come from the request rather than configuration.\n //\n // The val's own origin is where InfinitePay must POST the payment\n // notification. Taking it from the incoming request means it cannot drift out\n // of sync with wherever this val actually lives.\n const valOrigin = new URL(req.url).origin;\n\n // The buyer goes back to the origin they checked out on — already validated\n // against ALLOWED_ORIGINS above, so it cannot be steered somewhere else. This\n // also keeps www and apex visitors on the host they started from, and sends a\n // local dev checkout back to localhost rather than production.\n const siteOrigin = origin ?? allowedOrigins()[0];\n if (!siteOrigin) {\n console.error(\"ALLOWED_ORIGINS is empty; cannot build a redirect_url\");\n return json(req, { error: \"misconfigured\" }, 500);\n }\n\n const orderNsu = crypto.randomUUID();\n\n const order = {\n order_nsu: orderNsu,\n book_slug: bundle.book_slug,\n quantity: bundle.units,\n amount_cents: amountCents,\n customer_name: name,\n customer_email: email,\n customer_phone: normalisePhone(str(body.phone, 32)),\n dedicatoria: str(body.dedicatoria, 500),\n cep: digits(str(body.cep, 20)),\n street: str(body.street, 200),\n neighborhood: str(body.neighborhood, 120),\n number: str(body.number, 20),\n complement: str(body.complement, 120),\n city: str(body.city, 120),\n state: str(body.state, 8),\n referral: str(body.referral, 80),\n };\n\n // Written before the API call so a failed or slow InfinitePay response still\n // leaves us with the buyer's shipping address.\n await insertOrder(order);\n\n const checkoutUrl = await createLink({\n order_nsu: orderNsu,\n // InfinitePay multiplies price by quantity, so this is the unit price and\n // the line total comes to bundle.units * bundle.unit_price_cents.\n items: [{\n quantity: bundle.units,\n price: bundle.unit_price_cents,\n description: bundle.title,\n }],\n redirect_url: `${siteOrigin}/pedido-confirmado/`,\n webhook_url: `${valOrigin}/webhook`,\n customer: {\n name: order.customer_name,\n email: order.customer_email,\n phone_number: order.customer_phone ?? undefined,\n },\n address: {\n cep: order.cep ?? undefined,\n street: order.street ?? undefined,\n neighborhood: order.neighborhood ?? undefined,\n number: order.number ?? undefined,\n complement: order.complement ?? undefined,\n },\n });\n\n await setCheckoutUrl(orderNsu, checkoutUrl);\n\n // Logged so a wrong derivation is obvious on the first order rather than when\n // a payment silently fails to register.\n console.log(\"order created\", orderNsu, {\n book: bundle.book_slug,\n units: bundle.units,\n unitPrice: bundle.unit_price_cents,\n discounted: bundle.discounted,\n total: amountCents,\n valOrigin,\n siteOrigin,\n });\n\n return json(req, {\n checkout_url: checkoutUrl,\n order_nsu: orderNsu,\n amount_cents: amountCents,\n });\n}\n\n/* ----------------------------------------------------------- POST /webhook */\n\nasync function handleWebhook(req: Request): Promise {\n const raw = await req.text();\n\n // Every branch below acks with 200 and says why: a 400 would make InfinitePay\n // redeliver, which is only wanted for genuinely transient failures. The\n // reasons go to Val Town's request logs rather than a table of our own.\n let body: Record;\n try {\n body = JSON.parse(raw);\n } catch {\n console.warn(\"webhook ignored: body is not JSON\", raw.slice(0, 500));\n return new Response(\"OK\", { status: 200 });\n }\n\n const orderNsu = str(body.order_nsu, 64);\n const transactionNsu = str(body.transaction_nsu, 120);\n const slug = str(body.invoice_slug, 120) ?? str(body.slug, 120);\n\n if (!orderNsu) {\n console.warn(\n \"webhook ignored: no order_nsu in the body\",\n raw.slice(0, 500),\n );\n return new Response(\"OK\", { status: 200 });\n }\n\n const order = await getOrder(orderNsu);\n if (!order) {\n console.warn(\"webhook ignored: unknown order\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n }\n\n if (order.status === \"paid\") {\n // Idempotency: InfinitePay retries, and we ack retries without re-emailing.\n console.log(\"webhook ignored: order already paid\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n }\n\n if (!transactionNsu || !slug) {\n console.warn(\n \"webhook ignored: no transaction_nsu or slug to verify with\",\n orderNsu,\n );\n return new Response(\"OK\", { status: 200 });\n }\n\n // The body is only a hint, and this endpoint is public — anyone can POST to\n // it. This call is the sole reason a forged notification cannot fabricate a\n // payment. Never mark an order paid on the strength of the body alone.\n const check = await paymentCheck({\n order_nsu: orderNsu,\n transaction_nsu: transactionNsu,\n slug,\n });\n\n const paidAmount = Number(check.paid_amount ?? check.amount ?? 0);\n\n if (!check.success || !check.paid || paidAmount < order.amount_cents) {\n // Either the notification was forged, or the amount does not cover the\n // catalog price. Both leave the order pending.\n console.warn(\n \"webhook rejected: payment_check did not confirm\",\n orderNsu,\n {\n success: check.success,\n paid: check.paid,\n paidAmount,\n expected: order.amount_cents,\n },\n );\n return new Response(\"OK\", { status: 200 });\n }\n\n await markPaid(orderNsu, {\n paid_amount_cents: paidAmount,\n installments: numOrNull(check.installments ?? body.installments),\n capture_method: check.capture_method ?? str(body.capture_method, 40),\n transaction_nsu: transactionNsu,\n invoice_slug: slug,\n receipt_url: str(body.receipt_url, 500),\n });\n\n // Emails are sent by the notify cron val so this stays inside the ~1s budget\n // the docs ask for, and so a mail failure can be retried without a redelivery.\n console.log(\"webhook verified paid\", orderNsu);\n return new Response(\"OK\", { status: 200 });\n}\n\n/**\n * One cheap read, with a deadline. Without the race a stalled SQLite would hang\n * the health check to Val Town's 1m request timeout, which is the failure this\n * endpoint exists to diagnose.\n */\nasync function probeDb(): Promise {\n try {\n return await Promise.race([\n selectOne().then(() => \"ok\"),\n new Promise((resolve) =>\n setTimeout(() => resolve(\"timeout after 5s\"), 5000)\n ),\n ]);\n } catch (error) {\n return `error: ${error instanceof Error ? error.message : String(error)}`;\n }\n}\n\n/* ------------------------------------------------------------------ helpers */\n\nfunction allowedOrigins(): string[] {\n return (Deno.env.get(\"ALLOWED_ORIGINS\") ?? \"\")\n .split(\",\")\n .map((o) => o.trim())\n .filter(Boolean);\n}\n\nfunction isAllowedOrigin(origin: string): boolean {\n return allowedOrigins().includes(origin);\n}\n\n/** Reflect the origin when it is allowed; never `*` — this endpoint writes. */\nfunction corsHeaders(req: Request): Record {\n const origin = req.headers.get(\"Origin\");\n const headers: Record = {\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Max-Age\": \"86400\",\n Vary: \"Origin\",\n };\n if (origin && isAllowedOrigin(origin)) {\n headers[\"Access-Control-Allow-Origin\"] = origin;\n }\n return headers;\n}\n\nfunction json(req: Request, body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...corsHeaders(req) },\n });\n}\n\nfunction str(value: unknown, maxLength: number): string | null {\n if (typeof value !== \"string\") return null;\n const trimmed = value.trim().slice(0, maxLength);\n return trimmed === \"\" ? null : trimmed;\n}\n\nfunction digits(value: string | null): string | null {\n if (!value) return null;\n const only = value.replace(/\\D/g, \"\");\n return only === \"\" ? null : only;\n}\n\nfunction numOrNull(value: unknown): number | null {\n const n = Number(value);\n return Number.isFinite(n) ? n : null;\n}\n\nfunction isEmail(value: string): boolean {\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]{2,}$/.test(value);\n}\n\n/** InfinitePay wants E.164; Brazilian numbers arrive as 11 digits at most. */\nfunction normalisePhone(value: string | null): string | null {\n const only = digits(value);\n if (!only) return null;\n if (only.length < 10 || only.length > 13) return null;\n return only.startsWith(\"55\") ? `+${only}` : `+55${only}`;\n}","deleted",false,"label",[14],"639ca8a8-1138-4d2c-8f90-70d7c3fd0872",["D",1789320759226],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Handles a web form, and sends a Resend confirmation email.","imageUrl","userId","019c60b1-a4d0-7731-935c-3d10ad61d034","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019c60b1-a4d0-7731-935c-42775a719a84","tursoName","639ca8a811384d2c8f9070d7c3fd0872","tursoHostname","639ca8a811384d2c8f9070d7c3fd0872-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789494690166],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":100},"org",{"_9":10,"_98":-5,"_99":100,"_55":56,"_101":102,"_103":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",28,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zOWhXUmxoUktmbGZNZFRQWnhlYWJFeWpGSjAifQ","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":89,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]